ZScaler Network SME

Agile Defense, Inc.; Ashburn (VA); Sur place; USD 170 000 - 185 000; Plein temps

Résumé du poste

Agile Defense, Inc. seeks a Zscaler Solutions Architect SME to drive enterprise-wide SASE implementations for DHS.

You will serve as the technical authority for designing, deploying, and optimizing ZIA, ZPA, and ZDX across multi-cloud and on-prem environments, partnering with IAM teams to implement SAML/SCIM and ensure zero-trust access. You will lead policy tuning, PAC file troubleshooting, and agent lifecycle management across Windows, macOS, iOS, and Android, while coordinating escalations

Qualifications

• Design, deploy, administer, upgrade and optimize Zscaler deployments across ZIA, ZPA, ZDX.
• Create, audit, tune security policies (URL filtering, DLP, SSL/TLS inspection, sandbox).
• Formulate and execute ZPA access policies for least-privilege private access.
• Provide Tier-3/4 escalation for proxy routing, PAC debugging, identity integration, latency issues.
• Manage ZCC deployment and upgrades across macOS, Windows, iOS, Android.
• Leverage ZDX and cloud analytics to isolate UX degradation; configure SIEM integrations.
• Partner with IAM teams to configure SAML/SCIM with IdPs (Okta, Azure AD, Ping).
• RCA and post-incident documentation; cross-functional coordination.
• Travel up to 20% within the United States.
• On-call readiness for 24/7 incidents and emergency changes.
• Evaluate enterprise tech integrations (Splunk, Cribl, Okta, AWS, Azure, GitHub).

Responsabilités

• Design, deploy, administer, upgrade and optimize Zscaler deployments (ZIA, ZPA, ZDX) across multi-cloud and on-prem environments.
• Create, audit, and tune security policies including URL filtering, DLP, SSL/TLS inspection and sandbox policies.
• Formulate and execute ZPA access policies for least-privilege direct access to internal apps in private clouds and data centers.
• Provide Tier-3/Tier-4 escalation support for proxy routing, PAC file debugging, identity integration, authentication drops and latency issues.
• Manage ZCC deployment, configuration, forwarding profiles, upgrades across macOS, Windows, iOS and Android.
• Leverage ZDX and cloud analytics to isolate user experience degradation; configure alerts and SIEM log integration (Splunk, Cribl).
• Partner with IAM teams to configure SAML/SCIM with IdPs (Okta, Azure AD, Ping Identity).
• RCA or post-incident reporting for mission-critical apps and infrastructure; document root causes and corrective actions.
• Travel up to 20% within the United States.
• Support 24/7 on-call rotation for Tier 3 incidents and Emergency Change Requests.

Connaissances

ZIA

ZPA

ZCC

ZDX

PAC Files

PowerShell

TCP/IP

DNS

Routing

Firewalls

VPNs

TLS/SSL

Formation

Zscaler ZIA administration certification

Zscaler ZPA administration certification

Zscaler ZDX training

Cisco CCNA

Cisco CCNP

CompTIA Security+

Zscaler Zero Trust training

Outils

Splunk

Cribl

Okta

AWS

Azure

GitHub

Docker

Git

VS Code

Visual Studio

Description du poste

Serve as a Zscaler Solutions Architect SME enabling the Department of Homeland Security (DHS) mission and enterprise network infrastructure. The applicant will serve as the primary technical authority for designing, deploying, administering, upgrading and optimizing enterprise-wide Secure Access Service Edge (SASE) solutions using the Zscaler cloud security platform. This role leads the operational architecture across Zscaler Internet Access (ZIA), Zscaler Private Access (ZPA), and Zscaler Digital Experience (ZDX), driving modern Zero Trust initiatives

• Architecture & Engineering: Design, implement, and maintain enterprise Zscaler deployments (ZIA, ZPA, ZDX, and Zscaler Client Connector) across multi-cloud and hybrid corporate environments.
• Policy & Governance: Create, audit, and tune security policies, including URL filtering, Cloud Application Control, SSL/TLS deep packet inspection, Data Loss Prevention (DLP), and sandbox policies.
• Zero Trust Deployment: Formulate and execute access policies within ZPA to enable least-privilege direct access to internal applications in private clouds (AWS, Azure, GCP) and on-premises data centers without traditional VPN overhead.
• Operational Troubleshooting: Serve as Tier-3/Tier-4 escalation support for complex proxy routing, PAC (Proxy Auto-Configuration) file debugging, identity integration, authentication drops, and application latency issues.
• Agent Lifecycle Management: Manage enterprise distribution, health checks, profile tuning, and version upgrades of Zscaler Client Connector (ZCC) across macOS, Windows, iOS, and Android platforms.
• Observability & Analytics: Leverage ZDX and cloud analytics to isolate user experience degradation across endpoint, network ISP, and application levels; configure automated alerting and SIEM log integration (Splunk, Cribl).
• Cross-Functional Integration: Partner with Identity and Access Management (IAM) teams to configure SAML/SCIM attributes with IdPs such as Okta, Microsoft Entra ID (Azure AD), or Ping Identity.
• Troubleshooting & Incident Management: Provide Tier 2/Tier 3 escalation support for network outages, circuit degradations, and performance issues; conduct root cause analyses (RCA) and coordinate vendor support.
• Documentation & Asset Management: Maintain accurate network diagrams (Visio), topology maps, inventory databases, standard operating procedures (SOPs), and change control tickets (ServiceNow/Remedy).
• Support On-Call & Escalation Management: support 24/7/365 on-call rotation readiness to respond to Tier 3 critical network incidents within SLA limits and coordinating cross-functional escalation pathways. When needed to restore services, the Senior Network Engineer will provide a solution and implement an Emergency Change Request (ECR), Emergency Break Fix (EBF), or Change Request.
• Root Cause Analysis (RCA) or Post Incident Reporting: Participate in the Root Cause Analysis (RCA) or post incident analysis of problems for mission critical applications, mission essential applications, and mission essential network infrastructure as well as recurring issues on the enterprise IT infrastructure.
• Project Support: Partner with program and project managers to align network engineering deliverables, milestone schedules, and resource planning with enterprise project objectives.
• Excellent problem-solving and analytical skills, with the ability to troubleshoot complex network issues.
• Scheduled and Adhoc Travel: Ability to travel within the United States either on short notice or scheduled, up to 20% of the time.

Required

1. Must have a minimum of 5+ years of relevant experience

The candidate should have strong hands-on experience with:

• Zscaler Internet Access (ZIA): Security policies, URL filtering, SSL inspection, traffic forwarding, authentication, and advanced troubleshooting.
• Zscaler Private Access (ZPA): App Connectors, application segments, access policies, private application connectivity, and troubleshooting.
• Zscaler Client Connector (ZCC): Deployment, configuration, forwarding profiles, upgrades, endpoint compatibility, and troubleshooting.
• Zscaler Digital Experience (ZDX): Application performance monitoring, network path analysis, latency investigation, and troubleshooting.
• PAC Files: Advanced knowledge of JavaScript-based PAC files, proxy configurations, routing logic, and application-specific bypass requirements.
• PowerShell: Scripting and automation for troubleshooting and operational support.

2. Enterprise Networking and Advanced Troubleshooting

The ideal candidate should have strong knowledge of TCP/IP, DNS, routing, firewalls, VPNs, TLS/SSL, proxy architecture, and network traffic analysis.

The SME should be able to independently diagnose complex connectivity, authentication, application performance, and security policy issues; coordinate with other technical teams; and document root causes and corrective actions.

Certifications

• Zscaler ZIA administration certification or equivalent official training.
• Zscaler ZPA administration certification or equivalent official training.
• Zscaler ZDX training or relevant certification, where available.
• Cisco CCNA or CCNP.
• CompTIA Security+.
• Relevant Zscaler Zero Trust or advanced security training.

MUST BE ABLE TO PASS A CBP BI

Nice to Have

Enterprise Applications and Technology Integration – Highly Desirable

Our environment includes a wide range of enterprise technologies and specialized applications. The SME should be comfortable investigating Zscaler-related connectivity, authentication, performance, and security policy issues involving:

• Security and monitoring: Splunk, Cribl, CrowdStrike, and Okta.
• Cloud platforms: AWS and Microsoft Azure.
• Developer tools: GitHub, Docker, Git, Visual Studio, VS Code, development repositories, APIs, and other enterprise development platforms.
• Mobile technologies: Mobile devices, mobile applications, wireless connectivity, VPN interactions, and mobile device management solutions.
• ZSIM: Connectivity and security troubleshooting involving ZSIM-related applications and infrastructure.
• WCTTV camera systems: Network connectivity, remote access, streaming, and security policy compatibility for camera-related services.
• Drone technologies: Connectivity and application access requirements associated with drone-related platforms, management software, and supporting services.

$170,000 - $185,000 a year